Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 19:37

General

  • Target

    fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe

  • Size

    747KB

  • MD5

    37888df004aa3046b1388383dd80adf1

  • SHA1

    531177ae8a01b4e6e14f89ec045d44076081dea5

  • SHA256

    fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96

  • SHA512

    a05c00dec7c753397e540c4f3a4cca4c74a30c9295cee2070bee8920800d4302cb83a2933cbe42c101fcd0df8ca4103568918a9a61cf39f284a7afbcced1b827

  • SSDEEP

    12288:Iy90sqaJpsFCf9E/fH4ir30LGYzs4Bde7k+HZC1XbN4wJnuyG5tyNoC:IyNoYu//Hr2Zs4WpHZCBbNZJuyGnW

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe
    "C:\Users\Admin\AppData\Local\Temp\fee0a609f1554529890f1c56c3aa61734e8e36e69bbf1afa749ec7e3b90e5f96.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1616
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4768
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3292

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un777065.exe

    Filesize

    593KB

    MD5

    e917f1d5245cbe7b6a95282f4013f7b7

    SHA1

    c5de960d37e2a9c6426eef72ef0484a210a9fb20

    SHA256

    ae58d6a2cac88313c3235194cadb02b4b32766effbf214cd3bd62e38b2946ce0

    SHA512

    1da045945ed6db620e3a04b3e9e05e537f04b70574ad538b02cafd563cf47bf70444ed8517a39eb25b25dedde3c77de9a5462bc21667c239728ac565aaae2f78

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25594768.exe

    Filesize

    377KB

    MD5

    f3e2f9f6609858f2b4ae4cd9015b71b9

    SHA1

    55e237e3b1163ae83260c71e625ca49e43d6f308

    SHA256

    01c15148cb46f0bcd6a9cfe5877fcfecc198707e79c1a897da81e5c194ca7284

    SHA512

    4d31ed5d147c94bab7963c71d45293dda8cb2df9a01db68815aea1b0e5c6804b057ebe4ea4562570538ad7ea87b3f73f7e115289291ac45b0c9a7f9b33f2a264

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk938003.exe

    Filesize

    459KB

    MD5

    960416951edc7cfa6a71a8763f926896

    SHA1

    a7932f375439309f2a7b4a2c6062b82a3a398dc1

    SHA256

    7c694c156db07b95ef4b411ca609b82a8bc9af4a02b5d32750fa67bb637c5daa

    SHA512

    f6cca0bb0111846120464af223774269a27e2e24019d95d0261302066b51910776cd2d28b05b0096a5348cb2f46182b79750c386b35dd3ff52f3c1af77119976

  • memory/3292-224-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-218-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-996-0x00000000080B0000-0x00000000080C2000-memory.dmp

    Filesize

    72KB

  • memory/3292-995-0x0000000007940000-0x0000000007F58000-memory.dmp

    Filesize

    6.1MB

  • memory/3292-992-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-991-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-564-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-567-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-998-0x00000000081F0000-0x000000000822C000-memory.dmp

    Filesize

    240KB

  • memory/3292-563-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-198-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-222-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-220-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-997-0x00000000080D0000-0x00000000081DA000-memory.dmp

    Filesize

    1.0MB

  • memory/3292-216-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-214-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-212-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-210-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-208-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-206-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-204-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-202-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-200-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-999-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-1001-0x0000000004F00000-0x0000000004F10000-memory.dmp

    Filesize

    64KB

  • memory/3292-194-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/3292-195-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/3292-196-0x0000000002A70000-0x0000000002AA5000-memory.dmp

    Filesize

    212KB

  • memory/4768-161-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-189-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/4768-185-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-184-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-183-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-181-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-179-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-177-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-175-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-173-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-171-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-169-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-167-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-165-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-163-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-159-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-157-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-155-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-154-0x0000000002600000-0x0000000002612000-memory.dmp

    Filesize

    72KB

  • memory/4768-150-0x0000000004F40000-0x00000000054E4000-memory.dmp

    Filesize

    5.6MB

  • memory/4768-153-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-151-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-152-0x0000000004F30000-0x0000000004F40000-memory.dmp

    Filesize

    64KB

  • memory/4768-149-0x0000000000400000-0x0000000000803000-memory.dmp

    Filesize

    4.0MB

  • memory/4768-148-0x0000000000810000-0x000000000083D000-memory.dmp

    Filesize

    180KB